VPNs with servers in Cyprus

A “serious criminal offence” is a felony or any offence carrying five years’ imprisonment or more. Providers must protect the data, limit access to authorised staff, log every access and destroy the data when the period ends (article 14); the Commissioner for Personal Data Protection supervises the law (article 15). Whether a VPN operator is a provider within the law is not established.

The National Betting Authority keeps a blocking list of unlicensed online betting sites. A blocked site shows a notice that access is prohibited under article 69 of the Betting Law of 2019 (37(I)/2019), because the provider holds no Class B bookmaker’s licence. Licensed online bookmakers operate only from addresses ending in .com.cy.

The racism law (134(I)/2011, amended most recently in 2026) punishes anyone who intentionally, in public or by public dissemination, incites violence or hatred against a group defined by race, colour, religion, age, disability, descent or national or ethnic origin, in a way that disturbs public order or is threatening, abusive or insulting. The penalty is up to five years’ imprisonment, a fine of up to €10,000, or both.

Publicly condoning, denying or grossly trivialising genocide, crimes against humanity or war crimes carries the same penalty where it is likely to incite violence or hatred; denial counts only for crimes recognised by a final international judgment or a unanimous resolution of the House. Identifying an author runs through the retention law above, since a five-year offence meets its definition of a serious offence.

On 1 February 2011 the Supreme Court held that articles 4 and 5 of the retention law, on police access to retained data, breach the Constitution, reasoning that they were not needed to implement the EU directive the law was passed to transpose.

A plenary decision of 27 October 2021, on challenges to court orders for access to telephone data, found that certain provisions of the law infringe Directive 2002/58, so that retention founded on them is unlawful. It did not annul the law, and it rejected the argument that the six-month ceiling guards against general and indiscriminate retention. The order of the rows is the security score, and a server’s location is not a recommendation.